Tight Certificates of Adversarial Robustness



Published on


Strong theoretical guarantees of robustness can be given for ensembles of classifiers generated by input randomization. Specifically, an ℓ2 bounded adversary cannot alter the ensemble prediction generated by an isotropic Gaussian perturbation, where the radius for the adversary depends on both the variance of the perturbation as well as the ensemble margin at the point of interest. We build on and considerably expand this work across broad classes of perturbations. In particular, we offer guarantees and develop algorithms for the discrete case where the adversary is ℓ0 bounded. Moreover, we exemplify how the guarantees can be tightened with specific assumptions about the function class of the classifier such as a decision tree. We empirically illustrate these results with and without functional restrictions across image and molecule datasets.

Please cite our work using the BibTeX below.

    title={Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers},
    author={Guang-He Lee and Yang Yuan and Shiyu Chang and Tommi S. Jaakkola},
Close Modal